⚠ Actively exploited
Added to CISA KEV on 2023-09-13. Federal agencies required to patch by 2023-10-04. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable..

CVE-2023-35674 — Improper Privilege Management in Frameworks Base

CWE-269 — Improper Privilege Management7 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 75.03%
CISA KEV
KEV
Added 2023-09-13
Due 2023-10-04
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedSep 11
KEV addedSep 13
KEV dueOct 4
Latest updateDec 4
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶Androidplatform/frameworks_base13-next:0 — 13-next:2023-09-01+4
▶CVEListV5google/android4 versions+3
▶NVDgoogle/android4 versions+3

Patches

Patch: android.googlesource.com ↗Patch: source.android.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-48cj-hmgx-8f7h: In onCreate of WindowState↗2023-09-11
▶
OSV
CVE-2023-35674: In onCreate of WindowState↗2023-09-01
▶
VulnCheck
Android Framework Privilege Escalation Vulnerability↗2023
▶

📋Vendor Advisories

2
CISA
Android Framework Privilege Escalation Vulnerability↗2023-09-13
▶
Android
CVE-2023-35674: Android Security Bulletin 2023-09-01 CVE: CVE-2023-35674 Severity: HIGH Type: EoP Affected AOSP versions: 11, 12, 12L, 13 References: A-264029851↗2023-09-01
▶

🕵️Threat Intelligence

1
Bleepingcomputer
December Android updates fix critical zero-click RCE flaw↗2023-12-04
▶